The vulnerability CVE-2026-10617 affects nextlevelbuilder GoClaw versions 3.11.0 through 3.11.3. It is caused by missing authentication checks in the resolveAuth function of the internal/http/auth.go file, specifically in the Webhook Verification Handler component. This allows remote attackers to bypass authentication mechanisms. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. Although the exploit has been publicly disclosed, there is no known exploit in the wild at this time. The vendor has not provided an official fix or remediation level.

The vulnerability enables remote attackers to bypass authentication in the affected versions of GoClaw, potentially allowing unauthorized access to webhook verification functionality. This could lead to unauthorized actions or data manipulation within the affected component. The CVSS score of 6.9 reflects a medium impact with low vector and integrity impacts but no user interaction or privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by the vendor, users should monitor for updates from nextlevelbuilder. Until a patch is available, consider restricting access to the webhook verification endpoint or implementing additional authentication controls externally if feasible.